Service provider-independent sat-based end-user authentication

SERVICE PROVIDER-INBEPENBENT SAT-BASEB END-USER AUTHENTICATION

0002BACKGROUND The present invention relates generally to methods and apparatus for providing end- user authentication services for network access providers and more particularly methods and apparatus that apply network security procedures to authenticate users who are requesting access to network applications.

0003The number of users who access data networks from remote locations increases each day. In many cases, a data network provider may wish to restrict network access to a group of users (such as customers, employees, etc.) and thereby create a private network. A private network is typically a network in which access to host sites of the private network is limited to authorized users. When a private network is connected to a public network, security procedures, including authentication procedures, should be carried out to ensure that only authorized users from authorized hosts can gain access to the private network. For example, when a user requests access to a host site of the private network from a remote location, the user must be authenticated before the user is granted access to the host site.

0004Some conventional authentication procedures use passwords. A password is a string of characters that may be recognized by automatic means to permit a user to access protected files or other system resource. Most sophisticated systems use authentication schemes based on passwords.

0005A password may be generated at a remote site that is requesting access to a host site of the private network. Some systems utilize either symmetric or asymmetric cryptographic techniques to create and authenticate the password. The continuous development of data networks has generated a wide range of computer services. In some cases, the services are restricted to a number of users providing service on a first-come, first-served basis. In other cases, the services are accessed on a commercial basis, i.e., the users pay to utilize the services. In the latter case, users must authenticate themselves using a service provision system of a service provider before they can gain access to the desired services. Typically, this requires the user to provide a unique username and password. The service provider verifies the username and password entered by the user against a database maintained by the service provider and grants access if the entered information matches the information in the database. In this manner, the service provider ensures that only users entitled to access the services can do so.

0006Cellular communication systems control resources of a network in a similar fashion. For example, in a Global System for Mobile Communication ("GSM") network, the mobile station (e.g., GSM phone) includes a Subscriber Identity Module ("SIM"). The SIM contains subscriber information, including data that permits the mobile station to gain access to the GSM network and utilize subscriber-based function of the network (e.g., calling party identification, voice mail, etc.).

0007Remote access to public or private data networks is growing tremendously, especially through dial-up connections such as public switched telephone networks ("PSTN") or the higher speed integrated services digital networks ("ISDN"). However, these dial-up connections are inherently insecure because they transmit data over open communication lines. Additionally, software for breaching security is quite advanced and more widely used than it was in the past. For example, software is available for guessing the passwords of authorized users of the network. Network diagnostic equipment can also be used to capture the user names and passwords of authorized users. Once user names and passwords become known, unauthorized users can pose as authorized users and gain access to the network. This problem can be overcome by using known authentication techniques.

0008Weak authentication, also known as single-factor authentication, uses a single method to authenticate a user. Weak authentication encompasses static passwords and one-time passwords. Static passwords can be broken by software programs, including keyboard strike monitoring programs, cracking programs for guessing passwords, and network sniffing programs. Static passwords can be protected from such software programs by generating a one-time password (one per session) that can not be calculated from previous passwords, e.g., by using a pseudo-random sequence as a calculation factor. The one-time password is generated from a "real" password that would never be transmitted over the network, and such a "real" password thus constitutes secret data that is shared by the user and the network.

0009Strong authentication, also known as two-factor authentication, is safer than weak authentication because it authenticates the user by two methods, typically a token and a password. Systems that generate one time passcodes from a token and a password are already available in the market, such as Security Dynamic's Secure ID, Safeword's Safeword DES Gold Card, and Digital Pathway's Defender. For example, the token may be a hardware device and the password may be a Personal Identification Number ("PIN") code needed to access the hardware device. The token typically contains some unique identification code. A passcode is generated by encrypting the user's PIN and the token's identification code. The network would then use the passcode to verify the user's identity. Strong authentication can be made still safer, for example, by introducing explicit authentication, in which the network generates a random factor as input to the user's password generation operation. This is known as a "challenge-response" procedure, in which the network challenges the user to give a correct response. Second, the life of the passcode can be short, e.g., one minute, and the authentication process can be repeated periodically during the session. Third, more sophisticated keys and algorithms, based either in symmetric or asymmetric cryptography, can be used. Nevertheless, increased sophistication usually requires additional time and processing power to perform the authentication task.

0010Both weak and strong authentication techniques have limitations. For example, static login/password methods provide weak security, and strong authentication methods require a user to hold additional devices, i.e., token devices. Some strong authentication mechanisms require specific hardware, e.g., smart card readers. Furthermore, some strong authentication methods require specific hardware and software configurations that create administrative burdens.

0011Some of these limitations and burdens can be overcome, or at least made more acceptable to the user, by combining different forms of authentication. For example, the token can be embedded in the hardware needed to access the network, like embedding a SIM card in a GSM phone.

0012Reliable authentication can also be achieved by using two different communication channels. One communication channel can be used to access a private service network and the other communication channel can be used to authenticate the user requesting access. In this case, one of the communication channels can be an unsecured channel connected to a data network over an access network and the other communication channel can be a secured channel that would exchange security information between a mobile station and the data network over a Public Land Mobile Network ("PLMN"). Under these circumstances, the authentication would take place over the secure channel, making it more difficult to steal authentication information. Once the authentication is completed, the secure channel would be released and could be used by others. Such an authentication scheme could be implemented using a GSM network as the secured communication path. This is discussed in commonly assigned, co-pending U.S. Patent Application No. 09/386,253, which was filed on August 31, 1999, by Jose Luis Mariz Rios and Jose Luis Ruiz Sanchez, entitled "GSM Security for Packet Data Networks", and which is incorporated in its entirety here by reference.

0013In GSM, the provider of cellular communication services ("GSM Service Provider") identifies the end-user by a SIM in the end-user's cellular terminal. The SIM, based on smart- card technology, is personalized and distributed to the end-user by the GSM Service Provider. The GSM-based identification of end-users can be re-used for applications that reside outside of the cellular system ("External Applications").. A typical implementation is shown in Figure 1. The end-user 100 uses a remote access device, such as a computer 102, to send an access request 104 to an External Application 106 through an Access Network 108, such as the Internet. The access request 104 is forwarded to an Authentication Server 110 that identifies the end-user 100 through his her Cellular Terminal 112 via communication over the GSM network 114. Typical examples of External Applications 106 that can utilize GSM- based authentication schemes include Internet services that require safe identification of the end-user, such as Internet banking and remote access to corporate local area networks ("LANs").

0014A simple authentication scheme is based on the generation of a Token 116 in the Authentication Server 110. The Token 116, typically a number or alphanumeric string that is preferably randomly generated, is sent in plain text over the GSM network 114 to the cellular terminal 112 of the end-user 100. The end-user 100 returns this Token 116 to the External Application 106 using the computer 102 connected to the External Application 106 through the access network 108. If the generated and returned Token is the same, the result of the authentication is positive. The advantage with such simple authentication schemes is that they are straightforward to implement and can be operated and controlled by the provider of the External Application, with minimal involvement of the GSM Service Provider.

0015More advanced authentication solutions can be implemented using SIM Application Toolkit ("SAT") technology. With SAT, the GSM Service Provider can store tailor-made software on the SIM card ("SAT Application"). The Authentication Server communicates with the SAT application over the GSM network, and identifies the end-user via an interaction on the cellular terminal. The result of the authentication procedure is communicated to the External Application.

0016An issue associated with SAT-based authentication mechanisms is that the GSM Service Provider and the provider of the External Application may be separate entities. This creates concerns regarding the division of liabilities between the entities, and a question of "who should control what" in the security chain.

0017The GSM Service Provider issues the SIM card, and, for security purposes, may desire to retain the control of this component. Hence, the GSM Service Provider is the only entity that will have access to the SIM card to insert SAT applications. A SAT-based authentication mechanism requires a back-end Authentication Server, and from the perspective of the GSM Service Provider, the Authentication Server should remain under the control of the GSM Service Provider. For example, in a symmetric authentication solution, the Authentication Server will contain the same secret key of the end-user as the one stored on the SIM card, and can therefore not be under the control of an external party.

0018The provider of the External Application, on the other hand, requires (in the majority of cases) to be in control of the authentication procedure for the External Application, and the associated end-user data base. From this perspective, it is the provider of the External Application that should control the Authentication Server.

0019These and other drawbacks of previous systems and methods are alleviated by Applicants' invention that provides service provider-independent SAT-based authentication.

0020SUMMARY In accordance with one aspect of the present invention, there is provided a system to authenticate an end-user. The system comprises an external application in communication with a first communication device through a first communication network. An authentication server is also in communication with the external application. The authentication server is adapted to receive an authentication request from the extemal application in response to an access attempt by the first communication device. The authentication server generates a token in response to the authentication request and sends the token through the external application to the first communication device. An authentication gateway is in communication with a second communication device through a second communication network. The authentication gateway is adapted to receive a token from the second communication device and transmit the token to the authentication server. When the token is received from the authentication gateway, the received token is compared to the token generated by the authentication server.

0021In accordance with another aspect of the present invention, the token is generated and verified by the authentication server, the authentication server and external application being controlled by a first common entity. The token may be encrypted throughout all communication paths, and the authentication server can simultaneously support encrypted and unencrypted tokens. A secret key may be stored in an authentication gateway, and the secret key may be used to decrypt the token transmitted from the first communication device to the authentication gateway, the authentication gateway and the first communication network being controlled by a second common entity. .

0022In accordance with other aspects of the present invention, the first common entity may be distinct from the second common entity, and advertisements related to the external application can be presented to the end-user via the first communication device.

0023In accordance with yet another aspect of the present invention, a method for authenticating an end-user comprises the steps of requesting access to an External Application; sending an authentication request from the External Application to the Authentication Server; generating a random Generated Token in the Authentication Server; presenting the Generated Token to the end-user via the External Application; and entering the end-user's PIN and the Generated Token. The method further includes calculating a cryptographic response based on the PIN, Generated Token, and Secret Key, and the calculation uses a cryptographic algorithm and the Secret Key resides within the SAT application; transmitting the response to an Authentication Gateway and an Authentication Server. The method still further includes decrypting the response with the Secret Key in the Authentication Gateway and decrypting the response with the PIN in the Authentication Server, with the decrypted response resulting in a Returned Token. In addition, the Returned Token is compared with the Generated Token, and access to the External Application may be granted if the Returned Token and the Generated Token are the same and if the Returned Token is received within a pre-defined time.

0024In accordance with another aspect of the present invention, there is a network architecture for authenticating an end-user. The network comprises at least one gateway connected to at least one communication network, wherein the at least one gateway provides authentication services to the at least one communication network. In addition, there is at least one server connected to at least one external application, wherein the at least one server provides authentication services to the at least one external application. At least one switch connects the at least one gateway to the at least one server, wherein any of the at least one gateways is accessible, through the at least one switch, by the at least one server. In accordance with another aspect of the present invention, there is a system for authenticating an end-user. The system comprises an external application in commumcation with a first communication device through a first communication network. An authentication server is in communication with the external application. The authentication server receives an authentication request from the external application in response to an access attempt by the first communication device. The authentication server generates a token in response to the authentication request and sends the token through the external application to the first communication device. An authentication gateway is in communication with a second communication device through a second communication network. The authentication gateway receives a first message from the second communication device and transmits a second message to the authentication server. The first message is based on the token and an end-user's PIN code, and the second message is compared to a result of a computation based on the token generated by the authentication server and a PIN code stored in the authentication server and associated with the end-user.

BRIEF DESCRIPTION OF THE DRAWINGS

0026The features, objects, and advantages of the present invention will become apparent by reading this description in conjunction with the accompanying drawings, in which:

0027Figure 1 is a block diagram that illustrates a method of authenticating a user known to the art; Figure 2 is a block diagram that illustrates a method of authenticating a user according to an exemplary embodiment of the present invention;

0028Figure 3 is a block diagram that illustrates a method of implementing a service to provide user authentication to a plurality of External Applications through a plurality of GSM networks; and Figure 4 is a flow diagram of the method for authenticating an end-user.

0029DETAILED DESCRIPTION In the following description, the invention is described in terms of a GSM communication system, but it will be understood that Applicants' invention is not so limited. The invention can be embodied in other types of communication systems that have appropriate features. In accordance with one aspect of the present invention, there is provided a SAT-based authentication method, whereby end-user authentication is based on three components: a secret PIN, a Secret Key, and a random number (Token). Control of these components is divided between two nodes: an Authentication Gateway (under the control of the GSM Service Provider), and an Authentication Server (under the control of the provider of the External Application). Preferably, communication between the Authentication Gateway and Authentication Server is encrypted. An exemplary architecture is depicted in Figure 2.

0030The PIN includes a secret string of keystrokes (e.g., an alphanumeric string) that is known by the end-user. The PIN can be stored and/or checked in the Authentication Gateway, in the Authentication Server, or locally on the SIM card. The Secret Key is stored on the SIM-card in connection with the SAT apphcation and, in the case of symmetric keys, in the Authentication Gateway. The Token (e.g., a random numeric or alphanumeric string) is generated and checked in the Authentication Server.

0031As can be appreciated, there are two possible authentication scenarios: Mobile Initiated and Network Initiated. In the Mobile Initiated scenario, an end-user 200 requests access (via an access request 202) to the External Application 204 and identifies himself/herself, e.g., by his/her Mobile Subscriber ISDN number ("MSISDN ") or other suitably unique user name. Typically, an access device 208 transmits an access request 202 to an External Application 204 through an access network 206. As will be appreciated, the access network 206 can be a GSM network, a PSTN, or other communication network, including a LAN. Access device 208 can be any suitable network terminating device, including, for example, telephones, computers, and personal digital assistants ("PDA").

0032The External Application 204 sends an authentication request 210 to the Authentication Server 212. The Authentication Server 212 generates a random Token 214 and presents the Token to the end-user 200 via the External Application 204. The end-user 200 reads the Token 214 from the External Application 204 and may select an "Authentication-option" from a menu on the authenticating device 216 (this option can be presented on the menu with the SAT application). The SAT application advantageously prompts the end-user 200 for a PIN and then for a Token. After the end-user 200 has entered the PIN and Token, the SAT application generates a response based on the PIN, Token, and Secret Key, using a predetermined cryptographic algorithm (e.g., Triple DES). If the PIN is stored/checked locally on the SIM, the response may be based only on the Token and Secret Key. The authenticating device 216 sends the response 218 back to the Authentication Gateway 222 via the GSM network 220. The response 218 is decrypted with the Secret Key (and the PIN, if available) in the Authentication Gateway 222, which forwards the decrypted response, now a Returned Token, to the Authentication Server 212. (If the PIN is stored in the Authentication Server 212, then the response forwarded from the Authentication Gateway 222 to the Authentication Server 212 is decrypted by the Authentication Server 212 to produce the Returned Token.) The Authentication Server 212 compares the Returned Token with the Generated Token. If the correct Token is returned within a pre-defined period of time (e.g., one minute), the result of the authentication request is positive and is communicated to the External Application 204 in the form of an authentication result 224. As can be appreciated, the Returned Token can be generated using non-reversible cryptographic algorithms. For example, a common cryptographic transformation, such as a hash function, that uses the Generated Token and/or PIN as input can be used to calculate the Returned Token. The Authentication Server 212 may also use the same hash function to calculate the expected response, again based on the Generated Token and/or PIN. The expected response would then be compared to the Returned Token.

0033The Network Initiated scenario differs from the Mobile Initiated case in the way the SAT dialogue on the authenticating device 216 is activated. In the Mobile Initiated scenario (described above), the SAT dialogue is initiated by the end-user, e.g., by selecting an "Authentication-option" from a menu displayed on the cellular terminal. In the Network Initiated scenario, the dialogue is initiated from the Authentication Server 212, via the Authentication Gateway 222, and further to the SIM card/cellular terminal via a message sent from the Authentication Gateway 222 over the GSM Network.

0034Figure 4 is a flowchart of the steps of a method of authenticating an end-user that is in accordance with Applicants' invention. First, in step 401, an External Apphcation receives an access request. Typically, this access request will be the result of an end-user's actively accessing the External Application, such as an internet banking website. In response to the access request, the External Application sends an authentication request to an Authentication Server in step 402. As can be appreciated, the Authentication Server and the External Application may both be software tasks running on the same computer, or they may be on separate computers connected by a network. The network may be a LAN or a telecommunication network.

0035In step 403, the Authentication Server generates a Token that preferably token is a pseudo-random sequence, e.g., of numbers and letters. The Token, in step 404, is transmitted to the accessing device. Typically, the end-user reads the Token from the accessing device and enters it into the authenticating device. The end-user may also need to enter a PIN into the authentication device to verify his identity, but the Token could also be transmitted without user intervention by cable, infra-red, or radio-frequency methods known to the art. Once the Token is entered into the authenticating device, the authenticating device generates a cryptographic response based on the Token, a Secret Key resident in the authenticating device, and possibly the PIN (step 405). The Secret Key is preferably embedded within the authentication device, but may also be encoded in a smart card or other access card that is held by the end-user and read by the authentication device.

0036In step 406, the response is sent to an Authentication Gateway and the Authentication Server. In step 407, the Authentication Gateway decrypts the response based on the Secret Key. The Authentication Server decrypts the Token based on the PIN or, if the PIN is not used in generating the response, the Authentication Server receives the Token from the

0037Authentication Gateway. As previously noted, one-way algorithms, such as hash functions, can also be used in place of reversible cryptographic algorithms. If the received Token matches the generated Token, access to the External Application is granted. The Authentication Server may also require that the response be received in a pre-determined period of time. If this is required and the response is received late, access to the external application may be denied.

0038As can be appreciated, the Token should be long enough so that it cannot be guessed by an intruder within the time allowed for response. In addition, the length of the Token is related to the cryptographic function used to combine it with the PIN and the encryption algorithm in the SIM- Authentication Gateway communication. On the other hand, the Token should also be short enough so that the end-user can successfully enter it into the authenticating device within the allowed response time. As can be appreciated, Applicants' invention has significant benefits over the prior art. For example, the provider of the External Application is in control of the Authentication Server and the associated end-user database (MSISDNs, and optionally, the associated user names and/or PINs). In addition, the provider of the External Application has the final control of the authentication procedure (comparing the Generated and Returned Token in the Authentication Server). This ensures that the provider of the External Application has full control over access to its content.

0039While the provider of the External Application retains control of the application, the Service Provider remains in control of the SIM card, SAT application, and the associated Secret Key. Via the Authentication Gateway, the GSM Service Provider gains access to a prime advertising channel. Advertisements related to accessed External Applications can be presented to the end-user via a SAT interaction on the Cellular Terminal.

0040The Token is transported in encrypted form throughout the transmission path SIM - GSM Network - Authentication Gateway - Authentication Server. In addition, every authentication request results in strong two-factor authentication of the end-user: it is verified that the end-user knows the PIN, and holds the SIM card. In case the PIN is stored and checked locally on the SIM card or in the Authentication Gateway, the end-user will only need to remember one password (PIN) for all External Applications that utilize the authentication method. Also, in case the MSISDN is used as user name, there will not be any need to remember application-specific user-names.

0041The Authentication Server in the proposed SAT-based scheme performs the same Token-based authentication check as in simple solutions, where the Token is sent in clear text over the GSM network. This makes it possible to support both solutions in the same Authentication Server. It also enables smooth migration from the simple solution to the more advanced SAT-solution, as more and more end-users acquire SAT-enabled SHVIs (and Cellular Terminals).

0042A method of service-provider independent authentication is complicated by the fact that there are currently more than 350 GSM networks in operation, a number that is constantly increasing. For a provider of an External Application, whose end-users can have subscriptions with any GSM network, relations must be maintained with a large number of GSM networks. This is needed both for simple authentication schemes (based on sending random Tokens in clear text over GSM), as well as for the more advanced SAT-based mechanism just described. The solution is to launch an operator-independent Authentication Service.

0043Figure 3 is an exemplary network architecture that could be used to provide an Authentication Service. The provider of the Authentication Service supplies Authentication Servers 310a, 31 Ob, 310c, 31 Od, 31 Oe, 31 Of to providers of External Apphcations 320a, 320b, 320c, 320d, 320e, 320f, such as Internet banks, enterprises offering remote intranet/extranet access, providers of high- valued Internet content, etc. These Authentication Servers 310a- 31 Of can preferably support both the simple, clear-text Token-based authentication mechanism, as well as the more advanced SAT mechanism. In addition, each Authentication Server 31 Oa-31 Of can concurrently service more than one External Application 320a-320f. Preferably, it is the responsibility of the provider of the External Application 320a-320f to register end-users in a database, indicate which GSM Service Provider 330a, 330b, 330c, 330d each subscribes to, and which authentication mechanism each uses.

0044The Authentication Service also supplies Authentication Gateways 340a, 340b, 340c, 340d, 340e to GSM Service Providers 330a-330d to handle the SAT-based authentication mechanism. As can be appreciated, Authentication Gateways 340a-340e can also be made available for a network-based authentication mechanism for networks other than GSM.

0045In addition, the Authentication Service operates one or more central switches 350 to provide simplified connectivity between providers of External Applications 320a-320f and GSM Service Providers 330a-330d. While the system shown in Figure 3 employs only one switch, the system could be duplicated to accommodate multiple switches with appropriate inter-switch connectivity. A variety of inter-switch connection schemes are known to the art. The Authentication Service is also responsible for monitoring the overall quality and security of the service, including the connections between the Authentication Servers 310a-310f and Authentication Gateways 340a-340e.

0046Various embodiments of the invention have been described, and those skilled in the art will likely make additional embodiments of this invention. For example, the first and second access device and network can be the same, thereby allowing an External Application to be accessed by a mobile phone. In addition, the invention can be embodied in other network technologies. For example, mobile networks that use a subscriber module, analogous to a SDVI, to identify an end-user can use Applicants' invention. In addition, additional services, such as advertising, can be provided to the GSM device during the authentication process. These and other alternate embodiments are intended to fall within the scope of the claims which follow.